Using its self-propagation functionality, several files in the malicious bundle receive videos and post them to the infected users’ YouTube channels along with the links to a password-protected archive with the bundle in the description.